Two DHCP Servers and One Saturated Fibre Line
A rural senior secondary school has 60 desktop computers: 22 in the admin office, 30 in the computer lab and 8 in the principal's office. One 100 Mbps fibre connection enters the admin building through an ISP router at 192.168.1.1/24. Admin PCs use static addresses 192.168.1.11–192.168.1.50. Last month the lab was given a Wi-Fi router with DHCP enabled and plugged into the same switch. Since then staff report random 'duplicate IP address' warnings and intermittent loss of the shared printer at 192.168.1.20. The school also wants a separate student Wi-Fi SSID that cannot reach admin PCs. There is no VLAN-capable switch, and the budget allows either one new managed switch or one additional broadband line, not both. During online board practicals, video traffic saturates the link and result uploads time out.
1. Explain the duplicate-IP symptom and state the two changes that will stop it without replacing every cable. Then propose an addressing plan using 192.168.1.0/24 split into /26 subnets for admin, lab and student Wi-Fi, giving network and usable host ranges.
Read the worked answer
Two DHCP servers are handing out addresses on 192.168.1.0/24: the ISP router and the new Wi-Fi router. A client can receive a lease from either, and the Wi-Fi router's pool may overlap the static admin range 192.168.1.11–.50. The printer at .20 is static, so a DHCP client can be given .20 and cause the duplicate warning.
Fixes without recabling: (1) put the Wi-Fi router in access-point mode and disable its DHCP server, leaving one DHCP authority; (2) keep statics outside the DHCP pool, e.g. pool .100–.199, and reserve .20 for the printer.
For /26 subnets on 192.168.1.0/24:
- Admin: 192.168.1.0/26, usable .1–.62, broadcast .63. Router .1, printer .20.
- Lab: 192.168.1.64/26, usable .65–.126, broadcast .127.
- Student Wi-Fi: 192.168.1.128/26, usable .129–.190, broadcast .191.
- Spare: 192.168.1.192/26, usable .193–.254.
Each /26 has 62 usable hosts, enough for 22, 30 and student devices. But without VLANs these subnets still share one broadcast domain, so separation is logical only.
2. The school can buy either a managed switch or a second broadband line. Which should it choose to fix both the IP conflicts and the isolation requirement? Justify in terms of OSI layer and cost, and state one thing the choice does not fix.
Read the worked answer
Choose the managed switch. The duplicate-IP problem is fixed by disabling the second DHCP server and separating static and dynamic ranges - that costs nothing. The isolation requirement is a Layer 2 problem: a managed switch can put admin, lab and student Wi-Fi in separate VLANs and apply an ACL so the student VLAN cannot reach the admin VLAN. A second broadband line adds bandwidth but does nothing for isolation and may add a third NAT/DHCP device. It also does not fix the printer conflict.
On the OSI model, the switch works at Layer 2 with ACLs, while the line is Layer 1 capacity. The switch does not add internet bandwidth, so video saturation remains; use QoS to prioritise result uploads and schedule video classes off-peak.
3. A teacher suggests giving every student Wi-Fi device a static IP in 192.168.1.200–192.168.1.250 to avoid DHCP. Give two operational reasons this is a poor decision for 120 student phones, and one security reason tied to the isolation goal.
Read the worked answer
Operationally, static addresses create a manual registry, and every new phone, reinstall or visiting device needs a unique address; the assistant will run out of time. Students can also change their own IP, so a static plan does not enforce order. Security-wise, address-based rules are weak: if the student VLAN is separated only by IP range, a student who sets 192.168.1.30 can impersonate an admin device. Isolation should be enforced by VLAN membership and switch-port/SSID mapping, with ACLs, not by trusting the address. Keep DHCP for students on the student VLAN; use reservations only for printers and access points.